Initia - Rekt

A published local replay shows the failure: Initia's virtual machine approved a script once, then kept honoring that approval after the code underneath it had been swapped out.

On October 23, an attacker exploited a script-caching bug to credit themselves with unbacked assets, without increasing the corresponding tokens' recorded total supplies.

In that replay, the stale approval let an attacker-made object enter a deposit function as a genuine token.

Then they used those balances to withdraw through the bridges. The systems on the other side paid out real assets: 1.4 million AUSD and 105 ETH through LayerZero, plus roughly 1.08 million USDC through Noble and Circle’s CCTP.

The attack began at 14:59 UTC. At 15:41:30 UTC, Initia halted its L1 and rollups. Five seconds later, the attacker consolidated 1,135.52 ETH into a fresh Ethereum wallet.

Stopping the source chain could not undo the payouts already made elsewhere.

Bitquery put the forged balances' face value at $7.48 million, against roughly $2.73 million extracted. Some of that paper value had no bridge exit.

The attacker withdrew 1.08 million USDC from the Noble reserve backing Initia's USDC.

Other users' withdrawals took most of what remained, leaving only $63 by 15:37 UTC.

Ordinary withdrawals began failing as the reserve emptied.

The failure began in Initia's VM. The bridges turned false balances into real proceeds.

When a bridge accepts a withdrawal as valid, who checks whether the balance behind it was ever backed?

Spreek raised the public alarm 28 minutes after the forged transaction.

By then, roughly $2.73 million had already escaped.

At 15:27 UTC, Spreek estimated $2.6 million already cashed out “thus far with more in flight.”

Bitquery’s later reconstruction records a successful 80,000 USDC withdrawal at 15:24, three minutes before his post.

Initia’s subsequent notice put the halt of its L1 and rollups at 15:41:30 UTC, roughly fourteen minutes after Spreek’s alert.

The notice said the team was “working to establish the full scope of any impact with security teams, validators, and exchanges." No loss figure. No cause. No restart time.

Co-founder Zon supplied some of that from his personal account: "To the best of our knowledge so far, this is a Day 0 bug related to Initia's MoveVM on CosmosSDK that allowed the exploiter to mint additional tokens on the Initia L1 but does not apply to native INIT tokens," he wrote, putting the haul at roughly $2.7 million in AUSD, ETH and USDC minted and bridged out before the pause.

Initia’s official account gave its own loss estimate the next day, confirming roughly $2.7 million bridged out.

D2 Finance traced the bridge payouts: 1.4 million AUSD released on Ethereum, followed by 105 ETH in a separate withdrawal. Those payouts depleted 71% of the AUSD adapter’s holdings and 96% of the native-ETH adapter’s, according to D2.

Agora also intervened on October 23, saying it would freeze hacker-linked AUSD on networks where its contracts operate, while stressing that it had no smart contracts deployed on Initia.

That distinction separated Agora’s own token and contracts from the bridged representation on Initia, and defined the limits of its response.

Agora used AUSD’s batchFreeze function to freeze the attacker’s Ethereum address, but by then the attacker had already swapped the 1.4 million AUSD payout for ETH.

The address held no AUSD when the freeze took effect, so the intervention neither reversed the payout nor recovered those funds.

Early accounts suggested the attacker had minted new tokens.

Spreek described tokens as “infiniminted,” while Zon said the bug allowed the attacker to “mint additional tokens.”

The mechanism turned out to be more nuanced.

Initia’s own explanation landed at 08:46 UTC on October 24, about 17 hours after the halt, and used a different verb: “Spoofed.”

The attacker "artificially spoofed the MoveVM state," Initia wrote, crediting themselves with unbacked WETH, iUSD and USDC without changing the corresponding tokens' total supplies. No native INIT was minted.

The distinction was not whether the forged balances could unlock real money. The bridge payouts had already shown they could. It was how those balances came to exist.

The bridge exits had accepted withdrawals against credits that no legitimate issuance had created.

So how did attacker-made data become a balance the system would let them spend?

Checked Once, Trusted Twice

Move's type rules were supposed to prevent an attacker-created object from passing as a genuine FungibleAsset, the object Move uses to represent tokens.

The VM normally verifies a script’s types before execution and rejects code whose types don’t line up.

Initia runs an Aptos-derived MoveVM. Its Rust implementation is compiled into a native library and connected to the Cosmos SDK chain through Go bindings.

In its October 24 statement, Initia attributed the incident to a bug in the MoveVM's script caching that let malicious code bypass security checks. It said the attacker spoofed VM state to credit themselves with unbacked token balances, without changing the tokens' recorded total supplies.

The statement did not identify a file, commit, or function.

A more detailed reconstruction came from researcher 0xCanzi, who published a local replay using real Move VM code, with transaction rollback modeled locally.

It offers a possible mechanism, not confirmation of the live attack's exact sequence.

In that reconstruction, a script was checked once, then trusted again after the code it had been checked against changed.

Move scripts are pieces of code submitted with transactions. In 0xCanzi's replay, the attacker first published a contract module called Router, whose swap function declares that it returns a FungibleAsset, but aborts when called.

A separate script converts the currency’s metadata address into a metadata object, calls swap, and passes its result to the primary fungible store’s deposit function. The metadata identifies the currency; referencing it does not create funds. The declared types line up, so the VM verifies the script and caches the result

Router’s first version then aborts deliberately. That rolls back the Router publication, but the script's cached verification result survives.

Next, the attacker republishes Router at the same address, this time with swap returning an attacker-built object called Quote, containing currency metadata and a claimed amount.

The attacker reruns the same script. The VM reuses its old verification result instead of checking the script against the replacement module’s changed return type.

As a result, the Quote reaches the deposit function under the stale type assumption. In the replay, deposit uses the object’s metadata to select the currency store and credits the claimed amount, increasing the demonstration balance by 3 million dollar-denominated units and emitting a DepositEvent.

A fresh VM with no cached result rejects the same setup with TYPE_MISMATCH.

The replay’s $3 million is a demonstration figure, not the incident’s loss.

The replay shows the deposit function adding the attacker’s claimed amount to a balance, offering a possible explanation for how balances increased without changing the corresponding tokens’ recorded total supplies, as Initia reported.

The team’s statement, however, does not confirm that the live attack followed this exact sequence.

Once the VM had accepted the forged balance, what was left downstream to question it?

Burn Here, Pay There

The gas money arrived six and a half hours before the exploit.

At 08:26:59 UTC on October 23, a withdrawal from Tornado Cash's 0.1 ETH pool delivered about 0.098 ETH to the Ethereum address that would later receive the bridge payouts.

Sprunky identified the relayer and transaction submitter.

Tornado Cash Gas Funding Transaction:
0x3fb58feaaff3abdc5d55e3c6128ea03b6527665d702c983630f7f1d2f26c4d49

Attacker EOA on Ethereum:
0xDD922c841d85E12dac2dc2eef5a5E29cFFf6edFA

Starting at 14:59:17 UTC, a single Initia account created unbacked balances in four batches over 13 seconds. Bitquery totals them at 3 million iUSD, 2 million AUSD0, 2 million USDC and 200 WETH, about $7.48 million at face value.

Bitquery has published one of the four transaction hashes.

Spreek posted the same one as a "sample fake mint" from Initia's own explorer.

Initia Account Behind the Forged Balances:
init1mkfzepqashsjmtpdcth0tf0znnlldm06a5m89u

Initia L1 Forged-Balance Transaction 1 - 14:59:17 UTC:
712111A48BA4D7F830133BCDE2B2E0ECED1962CED9D8CE118381CFBD1F1C14F5

Initia L1 Forged-Balance Transaction 2 - 14:59:21 UTC:
7F0A72758F661A5D7C057B9DEFBBB9F8E0D769CA91DD478C677D9D8FF3720EEF

Initia L1 Forged-Balance Transaction 3 - 14:59:26 UTC:
67423E84815CEC63632BD4676CA22D33567F3E02C3187281C9B6BFD593CBA7AF

Initia L1 Forged-Balance Transaction 4 - 14:59:30 UTC:
3F165329DE9C4415C58C76FDA9F7F6E7CAA5F76159F287B109812ECADD0919A3

AUSD0 is the Initia-side representation of AUSD bridged from Ethereum through LayerZero.

The attacker sent the unbacked AUSD0 from Initia through LayerZero, and the Ethereum bridge contract released real AUSD from its reserve.

At 15:01:59 UTC, the Ethereum bridge contract released 1.4 million AUSD to the attacker’s address.

LayerZero AUSD Release (1.4M AUSD):
0x034c1076a08091b3221ef1e7bbcfb47dfeda93a6e460888f2d1bc124be17f3b6

Ethereum Bridge Contract Holding AUSD for Initia:
0x38b8b7ca28e672018a299b20565aca8cf200c844

At 15:03:23 UTC, the attacker routed it through 1inch for 581.55 ETH.

AUSD-to-ETH Swap via 1inch (581.55 ETH):
0xeb5e85e76f00a7a84dfe4d2d6aab146a769785b3d80307c67dde14c79f36c5ae

The USDC took a different road. Bitquery records 1 million USDC paid from Noble's reserve backing Initia's USDC and moved to Ethereum through Circle's CCTP.

Noble USDC Reserve for Initia:
noble1j8rrc5epz0wppvl7jpy9p7q0u4ky9dcegaw3cu

At 15:04:59 UTC, the attacker routed approximately 1 million USDC through 1inch and received 415.70 ETH. The route included swaps through Uniswap V3, with some USDC converted to USDT along the way. The transaction alone doesn’t establish where the USDC came from; Bitquery’s flow table traces the proceeds to the 1 million USDC withdrawal.

Second 1inch Swap, USDC and USDT (415.70 ETH):
0x6981eed05757cfbce5ac7818449b28132dcb400361029ed3452037936c66c3b0

At 15:06:47 UTC, the native-ETH bridge contract paid out 105 ETH, no swap required.

Native-ETH Bridge Release (105 ETH):
0x5cd422fd8166abf5d8632e9919bfedf6e26f5b77cf732cc797d863450887d7e9

Ethereum Bridge Contract Holding ETH for Initia:
0x66a503a1060ab3f2b1aaabed613fe30babbc1bde

A second 1 million USDC request at 15:07 bounced; the reserve could not cover it.

The last successful withdrawal request came at 15:24 UTC: 80,000 USDC from the Noble reserve, which Bitquery traces to about 33.18 ETH.

Initia put its halt at 15:41:30 UTC. The sweep followed five seconds later: At 15:41:35 UTC, 1,135.52 ETH, roughly $2.72 million at the time, moved into a fresh wallet.

Consolidation Transaction (1,135.52 ETH):
0x60f15b7e96111f11af54a2a0c9adc2ff33fef6b6a3c1a3b073a55c1421043e06

Consolidation Wallet:
0x358eF0130f7A5aA516dCd81Bdc80B18CdE41CAC8

Bitquery’s account broadly reconciles the consolidation: 581.56 ETH from AUSD, 415.70 ETH from the first USDC withdrawal, 105 ETH bridged directly, and 33.18 ETH from the later 80,000 USDC withdrawal, plus roughly 0.098 ETH in initial funding. The figures are rounded, and some ETH was spent on fees.

Agora’s freeze landed at 16:31:59 UTC in block 26,256,539 - one hour, 28 minutes and 36 seconds after the AUSD-to-ETH swap. Sprunky counted 441 blocks between them. The attacker’s AUSD balance at the moment of the freeze was zero.

Agora batchFreeze Transaction:
0x9df56874a61efc7c84aecc9263a384578d70ec28734990cb74febc3003b794db

batchFreeze Caller:
0xcF7D2a525057555d7b4816941185b7ae10E94681

AUSD Token Contract:
0x00000000eFE302BEAA2b3e6e1b18d08D69a9012a

Bitquery reports that the Ethereum AUSD bridge blocked another 200,000 AUSD payout at 17:51 UTC. Four of the five required verifiers had signed, but LayerZero Labs' verifier had not.

Initia named the consolidation wallet in its October 24 statement.

Since then, the funds have started to move.

On October 27, the wallet sent out 400 ETH in two 200 ETH transfers, both to the same recipient address.

First Outgoing Transfer from the Consolidation Wallet - 200 ETH:
0xf35dcdd4c23816adcd5e1fb6578a75c2d43b4816bf78203b6721cfb59b9cc7f1

Second Outgoing Transfer from the Consolidation Wallet - 200 ETH:
0x383a55d8caf78c926a5022b8b7a386d1cc31369ca095cdb6b2dc093703b3f038

Recipient of Both Transfers:
0xA764b87FCB14bC850B68DfE41720Cba3b24a89C0

The recipient then distributed ETH to several other addresses. Its subsequent activity included a 100 ETH Tornado Cash deposit.

The attacker had turned forged balances on Initia into real assets on Ethereum. Agora’s freeze came after the AUSD had been exchanged for ETH, and the consolidation wallet later began sending that ETH onward.

Back on Initia, Bitquery counted $4.55 million in unbacked balances remaining when the chain halted, at face value.

That was not money already withdrawn, but forged balances still recorded on the chain, raising the question of how they would be handled before a safe restart.

If the chain resumes, what happens to balances that were never backed?

Halted, Not Settled

Initia's recovery had reached the audit stage, but not a scheduled restart.

On October 27, the team said a security fix had been drafted and was under audit with security partners.

Once those audits were complete, it would provide concrete plans for restoring the backing of affected assets and restarting the L1 and rollup networks in an orderly manner.

The team expected to complete the process “in the coming days,” but gave no firm restart date.

On October 28, Initia said the backing of affected assets would be fully restored when the chain resumes, with help from the Initia Foundation.

The Foundation approved funding to restore 1:1 backing for affected Noble USDC, WETH and AUSD0 held as iUSD collateral. The commitment covers verified shortfalls up to 1.08 million USDC, 105 ETH and 1.4 million AUSD0, following reconciliation and final transfer approval.

The announcement establishes a funding commitment, not completed transfers.

Exchanges applied their own controls. KuCoin suspended INIT deposits and withdrawals on October 24.

On October 26, Upbit and Bithumb designated INIT a trading-caution asset.

INIT fell to about $0.115 on October 23 before rebounding above $0.15, and recovered to $0.24 by October 28.

The more direct damage was in the reserves that paid out against forged balances.

The Ethereum contract holding AUSD for Initia gave up 1.4 million AUSD and the contract holding ETH lost 105 ETH, about 71% and 96% of their holdings by D2's count.

The Noble reserve behind Initia's USDC hit $63 at 15:37 UTC on October 23 and had recovered only to about $24,000 by 18:52 UTC that day.

Holders’ exposure depends on the token and its backing arrangements. The AUSD, ETH and USDC reserves were depleted to different degrees.

Separately, Bitquery counted $4.55 million in forged balances remaining on Initia when the chain halted, including 3 million iUSD valued at $1 each. Two attempts to swap some of that forged iUSD into AUSD0 failed.

Face value is not realizable value, and not every forged representation was necessarily transferable or redeemable.

The Foundation has approved funding for specified backing shortfalls, subject to reconciliation and final transfer approval. That commitment does not specify how the remaining forged balances will be treated.

Restart timing, treatment of those balances and completion of the backing transfers remain separate questions.

Zon called it a "Day 0 bug." When checked on October 28, Initia's public movevm repository listed no published security advisories.

The VM had been put in front of reviewers. Code4rena’s January 7 to 28, 2025 Initia Move contest included code changes between two specified versions of Initia’s movevm repository in its review scope, and the contest brief directed reviewers toward the JSON interface and the IBC bridge hook.

The brief does not identify script caching as a suggested focus. It also does not establish whether reviewers tested the rollback-and-republication interaction described in the later replay.

The same brief links an earlier Zellic report on Initia, which records 34 findings, including two rated critical. Its scope included parts of Initia’s movevm repository, including changes to VM code relative to an upstream Aptos version.

That scope listing does not establish whether reviewers tested the specific script-cache interaction described in the later replay.

The published local replay reconstructs a failure involving cached verification, transaction rollback and module republication, with rollback modeled locally.

That reconstruction suggests a targeted test: Compare the same script’s execution in a VM retaining its earlier verification result with execution in a fresh VM after rollback and module replacement. In the replay, the cached approval allowed the forged object through, while the fresh VM rejected it with TYPE_MISMATCH.

That contrast would flag the kind of stale-verification mismatch demonstrated in the replay.

Hexens documented a separate stale type-tag cache flaw in Aptos’s Move VM, involving entries that survived a partial cache flush.

It concerns a different cache and mechanism from the script-verification failure described in the Initia reconstruction.

The comparison illustrates a broader cache-consistency risk; it does not establish that Initia's fork contained the Aptos flaw.

Restoring asset backing and restarting the networks are related tasks, not interchangeable ones: Repairing the VM does not replace the assets already paid out.

The Foundation has committed to filling the gaps; reconciliation and final transfer approval still stand between that commitment and restored backing.

When does a funding promise become a restored backing, and tokens holders can actually redeem?

Initia's failure turns on a dangerous assumption: An old approval still applies.

In the published local reconstruction, a virtual machine kept a verification result after the code behind it changed.

Separately, the on-chain record shows successful bridge exits paying real assets against forged balances.

LayerZero carried the successful AUSD and ETH withdrawals; USDC left through Noble and Circle's CCTP.

About $2.73 million reached Ethereum before the halt. Another $4.55 million in forged face value remained on Initia.

Nearly seven weeks earlier, Liquid Network’s bitcoin reserve fell from approximately 4,205 BTC to 197 BTC following an exploit involving cached range-proof verifications and additional withdrawals before the halt.

The mechanisms differ, but the lesson connects them: A saved verdict is safe to reuse only while it still applies to what is being checked.

In the Initia replay, Move's type protections failed when execution relied on a check tied to an earlier version of the code.

A patch can close the flaw. A restart can resume execution. Neither, by itself, replaces the assets already paid out.

The Foundation has committed to covering the shortfalls. Delivering that backing is the next test.

How many other systems are still trusting an approval whose assumptions no longer hold?

REKT sert de plateforme publique pour des auteurs anonymes, nous déclinons toute responsabilité quant aux opinions ou contenus hébergés sur REKT.

faites un don (ETH / ERC20): 0x3C5c2F4bCeC51a36494682f91Dbc6cA7c63B514C

avertissement:

REKT n'est responsable en aucune manière du contenu publié sur notre site Web ou en lien avec nos Services, qu'il soit publié ou occasionné par l'Auteur Anon de notre site Web, ou par REKT. Bien que nous fournissions des règles pour la conduite et les publications de l'Auteur Anon, nous ne contrôlons pas et ne sommes pas responsables de ce que l'Auteur Anon publie, transmet ou partage sur notre site Web ou nos Services, et ne sommes pas responsables de tout contenu offensant, inapproprié, obscène, illégal ou autrement répréhensible que vous pourriez rencontrer sur notre site Web ou nos Services. REKT ne saurait être tenu responsable de la conduite, en ligne ou hors ligne, de tout utilisateur de notre site Web ou de nos services.